the United States was tied to air travel.

However, CDC has faced long-standing challenges to collecting and

sharing timely, accurate, and complete contact information for air

passengers with local public health authorities to facilitate contact

such as testing or quarantining, is critical to stopping the chain of disease

transmission. Inaccurate or incomplete contact information may delay or

even preclude notifying an exposed passenger, potentially leading to

broader community spread of a disease.

These challenges have been exacerbated by the ongoing COVID-19

global pandemic. For example, CDC officials estimated that the number

of flights warranting a contact investigation in 2020 increased more than

10,000 percent from 2019—taxing the aviation and public health sectors’

systems and resources.

The CARES Act includes a provision for us to report on our ongoing

information to facilitate contact tracing. This report addresses:

complete air passenger contact information from airlines and other

sources;

To conduct this work, we reviewed relevant statutes and regulations

pertaining to contact tracing for air travel. We also assessed the activities

of the three key federal departments with roles in facilitating contact

tracing for potentially exposed air passengers—the Department of Health

and Human Services (HHS); Department of Homeland Security (DHS);

and Department of Transportation (DOT)—as well as their relevant

components, including HHS’s CDC, DHS’s U.S. Customs and Border

Protection (CBP), and DOT’s Federal Aviation Administration (FAA). And,

we interviewed officials from four of the 20 CDC regional quarantine

stations: Atlanta (Hartsfield-Jackson Atlanta International Airport);

quarantine station, among other factors.

To identify and obtain perspectives on factors affecting CDC’s ability to

collect timely, accurate, and complete passenger contact information, in

addition to speaking with officials from identified agencies, we interviewed

or received written responses from six selected U.S. commercial

passenger airlines: American Airlines, Delta Air Lines, JetBlue Airways,

Southwest Airlines, Spirit Airlines, and United Airlines. We selected these

airlines based on passenger volumes and seating practices, among other

characteristics. We also interviewed representatives from four industry

groups representing the aviation sector, two associations representing

associated implementing orders, technical instructions, and submitted

public comments. In addition, we reviewed applicable CBP documents

describing the expansion of coordination efforts between CDC and CBP

in collecting information for passengers traveling on flights to the United

data entry, information processing and information system design, and

program monitoring; and 4) leading practices GAO has previously

identified for program evaluation and performance measurement and

evaluation. As part of our assessment, we reviewed a sample of data

from and available documentation on CDC’s Quarantine Activity

Reporting System (QARS) and interviewed CDC officials. Additional detail

on the scope and methodology of our review is contained in appendix I.

We conducted this performance audit from February 2021 to July 2022 in

accordance with generally accepted government auditing standards.

Those standards require that we plan and perform the audit to obtain

aviation system’s preparedness to respond to such threats.

2022, more than 86 million cases of COVID-19 had been reported in the

diseases to move quickly from one part of the world to another. Beginning

with the 2003 severe acute respiratory syndrome (SARS) epidemic, a

number of communicable disease threats—such as the 2009 H1N1

influenza pandemic, the 2012 Middle East Respiratory Syndrome (MERS)

concerns regarding international transmission of diseases from travel.

The SARS epidemic was the first major new disease of the 21st century,

according to the World Health Organization (WHO) of the United Nations.

WHO described that 2003 epidemic as a watershed event because it

revealed how much impact communicable diseases can have in a highly

could be several reasons for this limitation.

First, according to one airline representative, airlines may not have

complete information because passengers are not required to provide

airlines all five of the essential data elements of contact information that

flight. And in the case of airlines operating under a marketing code-share

agreement, passenger contact information may be collected by the

marketing airline and not available to the operating airline to provide to

CDC, according to representatives from an airline association.

Second, passengers may choose not to provide the airline with accurate

or complete contact information, according to representatives from three

airline associations and from two of the six airlines we interviewed. These

airline representatives highlighted that airlines lack a means to confirm

the accuracy of passenger-reported information.

Finally, passenger contact information may be incomplete as a result of

provide their own contact information as a way to support customers (i.e.,

Time for airlines to provide information. CDC has reported that prior to

exposed passengers and share this information with local public health

authorities. This delay can contribute to broader community spread of a

disease, as potentially exposed passengers may become difficult to

passenger resides or is staying in the United States—because CBP

checks the information against a passenger’s passport, and the

Since the COVID-19 global pandemic began in March 2020, CDC has

taken some actions to improve the timeliness, accuracy, and

completeness of the information it collects from various sources for

included expanding coordination with CBP and establishing new

In response to the COVID-19 pandemic and following a series of

Presidential proclamations, CBP, in coordination with CDC, has taken

steps to provide more timely and complete information to CDC for

passengers on inbound international flights believed to have been

travel to the United States under an approved exemption. For example,

following the identification of the Omicron variant in South Africa, a

Presidential proclamation on November 26, 2021, invoked section 212(f)

of the Immigration and Nationality Act to restrict travel of noncitizens with

person-centric records for each traveler, and transmit the record to CDC

within 8 hours of the flight’s arrival through a secure data file transfer.

In February 2021, CBP expanded the agreement with CDC to allow CBP

flights beyond those who recently traveled from 212(f)-restricted

countries.

In some cases, however, CDC continues to rely on the labor-

intensive, semi-automated process of submitting a request to CBP for

specific passengers identified through airline manifests. CDC officials also

told us that as of December 2021, no decision had been made as to

whether CBP’s automated process of search and transmission would

continue beyond the pandemic.

Second, CBP expanded the number of federal datasets it searches for

Since the onset of the COVID-19 pandemic, CDC has taken several

regulatory actions that increased the requirements for airlines to collect,

maintain, and transmit to CDC specific elements of passenger

information. Prior to the pandemic, CDC regulations for contact tracing

generally did not require airlines to collect any specific data elements

from passengers to support contact tracing or to provide them in any

they are ultimately willing and able to comply with them.

In early 2020, following the first reported cases of COVID-19 in China,

CDC held discussions with the airline industry and other federal agencies,

information CDC could collect from airlines. In February 2020, CDC

issued an Interim Final Rule requiring airlines to, in response to a CDC

order, collect and provide CDC with five designated pieces of information

for passengers traveling on inbound international flights.

interim rule, CDC issues implementing orders to airlines to trigger the

requirements.

In October 2021, CDC issued its most recent order—a global contact

tracing order, which requires airlines to collect, maintain, and, after

receiving a CDC request, transmit to CDC specific elements of passenger

international flights no more than 72 hours before departure. CDC

By requiring airlines

to provide CDC data in a specified format, the information can be

requirements.

from four airline associations and three airlines, highlighted that FAA’s

leadership and knowledge were particularly helpful in “translating” the

nuances of airlines’ processes and systems for CDC officials.

On the other hand, representatives from a major airline association and

one airline told us that despite repeated requests, CDC has not

communicated with them where the gaps exist in the passenger

information it collects, or the extent to which these requirements would

complete and up-to-date information for passengers traveling on inbound

international flights. CDC officials said that, as of March 2022, they were

undertaking an assessment of these improvements, but that the results of

officials and airline representatives told us in March 2022 that they

when, or if, a permanent rule will be issued.

states that CDC promulgated the rule in response to the COVID-19 public

health emergency and that the rule will cease to be in effect either when

the pandemic is over or when the Secretary of HHS determines there is

While CDC has taken some steps to improve the quality of information it

collects for passengers on inbound international flights, other limitations in

how CDC collects and manages air passenger information have not been

addressed and hinder the agency’s efforts to facilitate contact tracing.

addition, CDC has not fully assessed potential opportunities to improve

management system does not meet CDC’s needs for disease

other sources, staff had to extract data from QARS and create

spreadsheets outside of the system to evaluate data. This process took

several months to complete, as CDC had to review each individual case

The limitations in the design of the QARS system prevent CDC from

meeting the standards of its own strategic documents or federal

standards for internal control. Specifically, CDC’s strategic documents call

for the ability to swiftly disseminate contact data to local public health

authorities, identify gaps in current prevention and control efforts, and

update aging technology systems in order to store, access, and transport

timely, quality data.

Federal standards for internal control state that

agencies should design information systems that help achieve their

objectives and respond to risks.

tracing, compared with more than an estimated 17,000 in 2020. Even so,

prior to the pandemic, CDC had been assessing the limitations in the

design of QARS and was in the early stages of developing a

modernization plan, according to officials. However, officials said CDC put

those efforts on hold during the height of the pandemic to focus resources

on their response efforts. In April 2022, officials told us they had

not finalized a work plan or timelines for when or if QARS would be

Strategy states, however, that an agency should provide resources

explicitly to leverage data assets, which includes ensuring that sufficient

human and financial resources are available to support the management,

maintenance, and use of strategic data assets, as well as data driven

agency decision-making.

connect CDC to state and local public health authorities would be among

the modernization efforts. CDC officials told us the agency is formulating

plans for specific funds.

The COVID-19 pandemic has revealed major shortcomings in CDC’s

process for facilitating contact tracing by state and local public health

authorities for passengers potentially exposed to communicable diseases

during flights. In a connected world, COVID-19 is not the first, and will

likely not be the last, communicable disease to spread quickly beyond

borders and threaten U.S. public health and the economy. Contact

tracing—when performed effectively in conjunction with other public

However, CDC faces significant challenges in collecting timely, accurate,

and complete passenger information. Recent efforts to improve the

quality of information it collects from airlines and CBP to facilitate contact

international flights—a small fraction of the total number of air travelers. In

In the short term, implementing sufficient data entry controls could enable

CDC to quickly improve the quality of its data. Further, undertaking

longer-term and more complex efforts—including assessing other ways to

improve the quality of air passenger information it collects and manages,

and updating or replacing its data system—can strengthen CDC’s ability

to monitor public health risks related to air travel, support contact tracing

consistent validation checks. (Recommendation 1)

the quality of air passenger information it collects and manages—

including opportunities to increase automation by adopting or establishing

data exchange standards—and take action, as appropriate, based on this

assessment. (Recommendation 2)

We provided a copy of this report to HHS, DHS, and DOT for review and

comment. In written comments reproduced in appendix II, HHS concurred

with our recommendations. DOT, DHS, and HHS also provided technical

We are sending copies of this report to the appropriate congressional

committees, the Secretary of the Department of Transportation, the

Secretary of the Department of Health and Human Services, the

parties. In addition, the report is available at no charge on the GAO

found on the last page of this report. GAO staff who made key

This report examines: (1) the factors that affect CDC’s ability to collect

timely, accurate, and complete air passenger contact information from

airlines and other sources; (2) the actions CDC has taken since the onset

contact information it collects; and (3) how effectively CDC collects and

flights. We focused on scenarios when the infected passenger is

departments with roles for facilitating contact tracing for potentially

exposed air passengers. Within these three departments we collected

and reviewed available documentation and interviewed officials from

various components that play a key role at their respective departments,

principally HHS’s CDC, DHS’s U.S. Customs and Border Protection

(CBP), and DOT’s Federal Aviation Administration (FAA).

Selected CDC quarantine stations. We interviewed officials from four

CDC quarantine stations co-located with international airports: Atlanta

(Hartsfield-Jackson Atlanta International Airport); Chicago (O’Hare

International Airport); Los Angeles (Los Angeles International Airport);

and San Francisco (San Francisco International Airport). We selected

these four quarantine stations from the 20 total stations based on several

at airports co-located with the quarantine station, number of states within

order to obtain a breadth of perspective on CDC’s collection and

management of air passenger information as these quarantine stations

would likely have routinely conducted contact investigations both before

and during the COVID-19 pandemic, as well as had regular contact with

airlines that provided both domestic and international flights. The views of

the officials we spoke with from these quarantine stations are not

generalizable to the views of all officials working in CDC’s quarantine

stations.

Selected airlines. We interviewed or received written responses from six

We then selected these airlines based on

international flights’ passenger volume, the operation of both international

and domestic flights, recommendations from stakeholders, and other

unique factors, such as booking and seating practices, among other

consider regional passenger airlines or air taxis in our selection because

regional airlines typically operate domestic flights on behalf of mainline

carriers. As a result, few regional airlines collect or transmit passenger

data to CDC for contact tracing. We also did not include cargo airlines or

respect to contact tracing for air travelers.

To address our objectives, we reviewed relevant statutes and regulations.

For example, we reviewed a number of regulatory documents including

for the Control of Communicable Diseases, as well as associated

To better understand factors affecting CDC’s process to collect and

manage air passenger contact information we reviewed policies,

guidance, and other documentation relevant to CDC’s process. In

particular, we reviewed CDC’s guidance to airlines and the public

regarding this process,

enhance preparedness against the introduction, transmission, and spread

of communicable diseases from foreign countries into the U.S.

local public health authorities,

two global distribution systems

companies,

and Travel Technology Association, a travel industry

association, to obtain broader stakeholder perspectives on contact tracing

for aviation.

To describe the actions CDC’s has taken since the onset of the COVID-

19 pandemic to improve the quality of air passenger contact information it

collects, we reviewed CDC regulatory documents related to its Interim

Heather Krause, 202-512-2834 or [email protected]

In addition to the individual named above, Paul Aussendorf, Eric

Villareal, Hayden Huang, Neelaxi Lakhmani, Diona Martyn, Josh Ormond,